Add option to log but not enforce connection filtering, reset proposal stats through Admin server API

[abhilash1in]

Description

1. Add option to log but not enforce connection filtering.
   • When ZK server is in dedicated mode and X509ZNodeGroupAclProvider.enforceDedicatedDomain is false and a client with ID not part of the corresponding dedicated domain tries to connect, ZK server logs a warning but allows the connection to be established. When X509ZNodeGroupAclProvider.enforceDedicatedDomain is true, ZK server disconnects the connection (current and default behavior).
2. Reset proposal stats through Admin server API (in line with stat reset 4lw command)
3. [Update: These changes were removed from this PR and will be incorporated in a different PR ] Removes misconfigured attempts to parse zookeeper.X509ZNodeGroupAclProvider related properties from zoo.cfg.
   • Let's take an example zoo.cfg line, X509ZNodeGroupAclProvider.setX509ClientIdAsAcl=true
   • This will not be captured by

     if (key.equals(X509AuthenticationConfig.SET_X509_CLIENT_ID_AS_ACL)) {
              X509AuthenticationConfig.getInstance().setX509ClientIdAsAclEnabled(value);
     } 
     

   • This is because X509AuthenticationConfig.SET_X509_CLIENT_ID_AS_ACL is equal to zookeeper.X509ZNodeGroupAclProvider.setX509ClientIdAsAcl, but key is X509ZNodeGroupAclProvider.setX509ClientIdAsAcl (without zookeeper.).
   • The zoo.cfg parsing of X509ZNodeGroupAclProvider and usage of associated setters (like in the above if block) was never being used so far.
   • Instead, we were relying on the default else block below to set X509ZNodeGroupAclProvider.setX509ClientIdAsAcl from zoo.cfg as zookeeper.X509ZNodeGroupAclProvider.setX509ClientIdAsAcl System property, which is then read by associated getters.

      else {
          System.setProperty("zookeeper." + key, value);
      }
     

Tests

mvn test -e -Dtest=X509ZNodeGroupAclProviderTest#testConnectionFiltering -DfailIfNoTests=false

Dedicated domain = DomainX

1. Authorized domain is allowed to connect

2023-05-12 16:40:16,314 [myid:] - INFO  [main:ZkClientUriDomainMappingHelper@76] - Client URI domain mapping root path: /zookeeper/uri-domain-map
2023-05-12 16:40:16,317 [myid:] - INFO  [main:ZkClientUriDomainMappingHelper@135] - Registering client URI domain mapping: DomainYUser --> DomainY
2023-05-12 16:40:16,317 [myid:] - INFO  [main:ZkClientUriDomainMappingHelper@135] - Registering client URI domain mapping: CrossDomainUser --> CrossDomain
2023-05-12 16:40:16,318 [myid:] - INFO  [main:ZkClientUriDomainMappingHelper@135] - Registering client URI domain mapping: DomainXUser --> DomainX
2023-05-12 16:40:16,318 [myid:] - INFO  [main:X509ZNodeGroupAclProvider@194] - New UriDomainMappingHelper has been instantiated.
2023-05-12 16:40:16,322 [myid:] - WARN  [main:X509AuthenticationUtil@74] - Key store location not specified for SSL
2023-05-12 16:40:16,322 [myid:] - WARN  [main:X509AuthenticationUtil@106] - Truststore location not specified for SSL
2023-05-12 16:40:16,322 [myid:] - INFO  [main:X509AuthenticationConfig@245] - zookeeper.X509ZNodeGroupAclProvider.dedicatedDomain = DomainX
2023-05-12 16:40:16,322 [myid:] - INFO  [main:X509ZNodeGroupAclProvider@237] - Id 'DomainXUser' belongs to domain that matches server namespace 'DomainX', authorized for access.
2023-05-12 16:40:16,323 [myid:] - INFO  [main:X509ZNodeGroupAclProvider@277] - Authenticated Id 'scheme: x509, id: DomainXUser' has been added to session 0x0 from host .

2. Unauthorized domain is not allowed to connect (connection filtering is enforced)

2023-05-12 16:40:16,323 [myid:] - INFO  [main:ZkClientUriDomainMappingHelper@76] - Client URI domain mapping root path: /zookeeper/uri-domain-map
2023-05-12 16:40:16,324 [myid:] - INFO  [main:ZkClientUriDomainMappingHelper@135] - Registering client URI domain mapping: DomainYUser --> DomainY
2023-05-12 16:40:16,324 [myid:] - INFO  [main:ZkClientUriDomainMappingHelper@135] - Registering client URI domain mapping: CrossDomainUser --> CrossDomain
2023-05-12 16:40:16,324 [myid:] - INFO  [main:ZkClientUriDomainMappingHelper@135] - Registering client URI domain mapping: DomainXUser --> DomainX
2023-05-12 16:40:16,324 [myid:] - INFO  [main:X509ZNodeGroupAclProvider@194] - New UriDomainMappingHelper has been instantiated.
2023-05-12 16:40:16,324 [myid:] - INFO  [main:X509AuthenticationConfig@245] - zookeeper.X509ZNodeGroupAclProvider.dedicatedDomain = DomainY
2023-05-12 16:40:16,324 [myid:] - INFO  [main:X509AuthenticationConfig@250] - zookeeper.X509ZNodeGroupAclProvider.enforceDedicatedDomain = true
2023-05-12 16:40:16,325 [myid:] - ERROR [main:X509ZNodeGroupAclProvider@243] - Id 'DomainXUser' does not belong to domain that matches server namespace 'DomainY', disconnecting the connection.

3. Unauthorized domain is allowed to connect with a warning log (connection filterning not enforced)

2023-05-12 16:40:16,325 [myid:] - INFO  [main:ZkClientUriDomainMappingHelper@76] - Client URI domain mapping root path: /zookeeper/uri-domain-map
2023-05-12 16:40:16,325 [myid:] - INFO  [main:ZkClientUriDomainMappingHelper@135] - Registering client URI domain mapping: DomainYUser --> DomainY
2023-05-12 16:40:16,325 [myid:] - INFO  [main:ZkClientUriDomainMappingHelper@135] - Registering client URI domain mapping: CrossDomainUser --> CrossDomain
2023-05-12 16:40:16,325 [myid:] - INFO  [main:ZkClientUriDomainMappingHelper@135] - Registering client URI domain mapping: DomainXUser --> DomainX
2023-05-12 16:40:16,325 [myid:] - INFO  [main:X509ZNodeGroupAclProvider@194] - New UriDomainMappingHelper has been instantiated.
2023-05-12 16:40:16,326 [myid:] - INFO  [main:X509AuthenticationConfig@245] - zookeeper.X509ZNodeGroupAclProvider.dedicatedDomain = DomainY
2023-05-12 16:40:16,326 [myid:] - INFO  [main:X509AuthenticationConfig@250] - zookeeper.X509ZNodeGroupAclProvider.enforceDedicatedDomain = false
2023-05-12 16:40:16,326 [myid:] - WARN  [main:X509ZNodeGroupAclProvider@247] - Id 'DomainXUser' does not belong to domain that matches server namespace 'DomainY'. Allowing connection for now, but client connection will be blocked/disconnected in future when dedicated domain connection filtering is enforced.

[desaikomal]

If you can answer the test case related, thing, that will help to approve the change.

[desaikomal]

thanks for working on this.

[desaikomal]

thanks for working on this.

[rahulrane50]

Overall LGTM thanks for making this change.

[rahulrane50]

If this is not correct then essentially we are doing lazy binding of these variables. Other way to fix this is fix these if blocks. I would suggest separate out this change into separate PR and test it independently and make sure "all" these fields are lazily bound in their getter methods.